COYOTE TROJAN FIRST TO USE MICROSOFT UI AUTOMATION IN BANK ATTACKS

Summary from the TLDR InfoSec newsletter

The Coyote banking Trojan is notable for being the first malware to utilize Microsoft's UI Automation (UIA) framework, transitioning from a proof-of-concept to actively targeting Brazilian banking and cryptocurrency users. It exploits UIA to steal credentials from browsers and can manipulate UI elements, such as address bars, to redirect victims to phishing sites, thereby complicating detection efforts. Akamai recommends monitoring for the presence of UIAutomationCore.dll in unknown processes and scanning for interactions with UIA named pipes as early indicators of infection.